# UNDF: UNDF-2026-000000278
diff --git a/packages/core/src/abstract-dialect/query-generator.js b/packages/core/src/abstract-dialect/query-generator.js
--- a/packages/core/src/abstract-dialect/query-generator.js
+++ b/packages/core/src/abstract-dialect/query-generator.js
@@ -346,11 +346,13 @@ class AbstractQueryGenerator {
     const tuples = [];
     const serials = {};
-    const allAttributes = [];
+    // CWE-407 fix: use a Set for O(1) membership test inside the double loop
+    // (for fieldValueHash -> forOwn key) to avoid O(rows * cols^2) complexity.
+    const allAttributesSet = new Set();
+    const allAttributes = [];
     let onDuplicateKeyUpdate = '';

     for (const fieldValueHash of fieldValueHashes) {
       forOwn(fieldValueHash, (value, key) => {
-        if (!allAttributes.includes(key)) {
+        if (!allAttributesSet.has(key)) {
+          allAttributesSet.add(key);
           allAttributes.push(key);
         }